Framework Core. Core function. Core function name in all caps. Two-character identifier. Core category. Category name. Two-character function ID, then a period, then a two-character category ID. Function ID must be the same as that of the containing function's id attribute. Core subcategory. Category ID, followed by a hyphen, then one or more digits. Category ID must be the same as that of the containing category's id attribute. Informative references to NIST SP 800-53 security controls. Contains a list of controls, a control family or, if 'all' flag is true, a '-1' control exception. This content model may need to change for future CSF versions. True if all '-1' controls are informatively referenced. Security control identifier (two-letter family id, then a hyphen, then one or more digits) Outcome describing a category or subcategory.